NANOG Meeting Presentation Abstract

Tutorial: ISP Security: Deploying and Using Sinkholes
Meeting:	NANOG28
Date / Time:	2003-06-02 3:30pm - 5:00pm
Room:	Seasons Ballroon
Presenters:	Speakers: Barry Raveendren Greene, Cisco Systems. Danny McPherson, Arbor Networks.
Abstract:	Sinkholes are a flexible security tool that add a wealth of new capabilities to an ISP\'s security toolkit. ISPs are using sinkholes to track infrastructure port scanning, identify and classify attacks, packet capture attack flows, trace attacks through their networks, and divert attack flows from the target of the attacks. Sinkholes also enable a variety of new applications brought about through necessity and growing operational experience. Sinkholes go beyond narrowly focused tools like black hole servers, Tarpits, and Honeynets. Sinkholes may be used to perform any or all of these functions, but often incorporate all of these and more. This tutorial will explain how to build a sinkhole, using generalized examples from ISP deployments around the world. Configuration using JUNOS and IOS will be used to demonstrate the various ways trigger routers and target routers in the sinkholes are safely, scalably, and efficiently configured. Architectural considerations relating to network topology and placement of sinkholes in the ISP\'s network will be covered, along with anycast deployment options. A multitude of tools that can be placed inside the sinkhole will also be discussed. These include a variety of freeware, shareware, home-built, and commercial tools - covering the diversity available to ISPs of any size. This tutorial is recommended to ISP engineers of all experience levels. The source materials are derived from live operational deployments, which can be modified and applied to any large IP transport network.
Files:	ISP Security: Deploying and Using Sinkholes ISP Security: Deploying and Using Sinkholes(PDF)
Sponsors:	None.

Back to NANOG28 agenda.

NANOG28 Abstracts

• Show All

• BGP Multihoming Techniques
  Speakers:
  Philip Smith, Cisco Systems;

• Deploying Interdomain IP Multicast
  Speakers:
  Mike McBride, Cisco Systems;

• Introduction to MPLS
  Speakers:
  Joe Soricelli, Juniper;

• Interception Technology: The Good, The Bad, and The Ugly!
  Speakers:
  Jeff Schiller, MIT;

• The National Infrastructure Assurance Council (NIAC) Vulnerability Disclosure Framework and What It Might Mean to the ISP Community
  Speakers:
  Jim Duncan, Cisco Systems; Paul VixieISC; .
  

• The National Infrastructure Assurance Council (NIAC) Vulnerability Disclosure Framework and What It Might Mean to the ISP Community
  Speakers:
  Jim Duncan, Cisco Systems; Paul VixieISC; .
  

• IPv4/IPv6 Dual-Stack on Abilene
  Speakers:
  Grover Browning, Indiana University;

• Research Forum: Inter-provider Coordination for Real-Time Tracebacks
  Speakers:
  Kathleen M. Moriarty, MIT;

• Research Forum: Achieving Record Speed Trans-Atlantic End-to-end TCP Throughput
  Speakers:
  Les CottrellStanford University; .
  

• ISP Security: Deploying and Using Sinkholes
  Speakers:
  Barry Raveendren GreeneCisco Systems; .
  Danny McPhersonArbor Networks; .
  

• ISP Security: Deploying and Using Sinkholes
  Speakers:
  Barry Raveendren GreeneCisco Systems; .
  Danny McPhersonArbor Networks; .
  

• Issues in IPv6 Deployment
  Speakers:
  Jeff Doyle, Juniper;

• XML-based Network Management Tools
  Moderators:
  Rob Enns, Juniper;

• @Home Cable Backbone Deployment Experiences
  Speakers:
  Cathy WittbrodtNone; .
  

• Bidirectional Forwarding Plane Deadness Detection
  Speakers:
  Dave WardCisco Systems; .
  Dave KatzJuniper Networks; .
  

• Bidirectional Forwarding Plane Deadness Detection
  Speakers:
  Dave WardCisco Systems; .
  Dave KatzJuniper Networks; .
  

• BGP Vulnerability Testing: Separating Fact from FUD
  Speakers:
  Sean Convery, Cisco Systems; Matthew Franz, Cisco Systems;

• BGP Vulnerability Testing: Separating Fact from FUD
  Speakers:
  Sean Convery, Cisco Systems; Matthew Franz, Cisco Systems;

• NRIC Best Practices for ISP Security
  Speakers:
  Ross Callon, Juniper;

• Implementation of ARIN\'s Lame DNS Delegation Policy
  Speakers:
  Ed Lewis, ARIN;

• MPLS-Based Synchronous Traffic Shunt
  Speakers:
  Yehuda Afek, Riverhead; Roy BrooksCisco Systems; .
  Nicolas Fischbach, COLT Telecom;

• MPLS-Based Synchronous Traffic Shunt
  Speakers:
  Yehuda Afek, Riverhead; Roy BrooksCisco Systems; .
  Nicolas Fischbach, COLT Telecom;

• MPLS-Based Synchronous Traffic Shunt
  Speakers:
  Yehuda Afek, Riverhead; Roy BrooksCisco Systems; .
  Nicolas Fischbach, COLT Telecom;

• BGP AS Number Exhaustion
  Speakers:
  Geoff HustonTelstra, author; .
  K ClaffyCAIDA; .
  

• BGP AS Number Exhaustion
  Speakers:
  Geoff HustonTelstra, author; .
  K ClaffyCAIDA; .